Shopware Twig Rendered-View Code Injection Regression (CVE-2026-23498)

Metadata

Affected Target

Summary

Shopware previously fixed CVE-2023-2017 by restricting Twig filters so that only allow-listed functions could be invoked from templates. CVE-2026-23498 is a regression of that fix: the allow-list check was not applied to array- and closure-crafted values passed through the map(...) filter override, allowing a PHP Closure that is not on the allow-list to be reached and executed during Twig template rendering. This effectively reopens the code-generation/injection issue (CWE-94) that the original 2023 fix was meant to close, scoped specifically to the map() filter path.

Vulnerability Details

Root Cause

Shopware’s Twig sandbox validates that filter-invoked callables belong to an allow-list of permitted functions, but the map(...) filter override’s handling of array-based/closure-crafted arguments does not run that same validation, letting a disallowed Closure execute during template rendering.

Attack Vector

1. An attacker with access to a Shopware surface that renders attacker-influenced Twig content (e.g. custom mail templates, CMS/theme blocks) crafts an array value that resolves to a PHP Closure not present on the Twig sandbox’s function allow-list.
2. That value is passed into a template expression using the map(...) filter.
3. When Shopware renders the template, the crafted closure is invoked without being checked against the allow-list, achieving code execution/generation inside the Twig rendering context.
4. Impact depends on which functions/classes are reachable through the crafted closure in that rendering context.

Impact

Bypasses a template-sandbox security control, enabling arbitrary code generation/injection (CWE-94) during Twig rendering — potentially leading to remote code execution in the context of the Shopware application, depending on what is reachable from the render path.

Environment / Lab Setup

Target:   Shopware 6.7.0.0 - 6.7.6.0
Attacker: HTTP client / access to a Twig-rendered content surface (e.g. theme or mail template editor)

Proof of Concept

PoC Script

The upstream source repository is advisory-only: it documents the regression, the CWE classification, and the patch/commit references, but does not include a standalone reproducer script or file. No script is included in this folder for that reason.

The source advisory describes the flaw at the code level (an array/closure bypassing the map() allow-list check) but does not publish a concrete payload or endpoint; the fix commit referenced below shows exactly what validation was added back.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected admin/theme-editor changes introducing map(...) filter usage with unusual array/closure arguments.
• Unexplained PHP errors or anomalous behavior originating from Twig template rendering paths.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/lukasz-rybak/CVE-2026-23498 on 2026-07-05.